The vulnerability resides in the VobSub subtitle decoder library used by Amlogic's DroidLogic SubTitleService on Nexbox A95X devices. An infinite loop occurs in get_vob_spu() when length fields are mismatched, causing the decoding thread to consume 100 % CPU until the OS can terminate it. Attackers can exploit this by sending crafted AMLU data over the open tcp/10100 listener or by creating a malicious VobSub (.sub) file that triggers the loop, leading to a denial‑of‑service condition on the affected television set.

Devices impacted are Amlogic Android SDK firmware on Nexbox A95X models that run the Amlogic S905X processor. The vulnerability is present in the shipped version of the libsub_vob component included with the DroidLogic SubTitleService, though specific revision numbers are not disclosed in the advisory.

The CVSS score for this issue is 6.9, reflecting medium‑to‑high severity. The EPSS score is not available, so the likelihood of real‑world exploitation cannot be quantified, and the vulnerability is not listed in CISA's KEV catalog. Exploitation is straightforward for unauthenticated remote users who can reach port 10100 or for local users who can supply a crafted subtitle file. Successful exploitation results in a DoS that may render the device unusable until a reboot or firmware fix is applied.